What Does “Secure” Actually Mean?
Every laptop manufacturer claims its devices are secure. Specification pages are filled with familiar terms such as Secure Boot, TPM, firmware protection and memory encryption. But a list of supported features doesn’t necessarily tell you what is present, what is enabled or how the laptop is configured today.
That is where Host Security ID, or HSI, comes in. HSI is part of the open-source fwupd project and gives Linux users a consistent way to inspect platform security. Rather than relying on a manufacturer's own utility or taking security claims at face value, it reports what the system itself finds.
We didn't create HSI, and it isn't specific to Star Labs. That's exactly why we like it. It's an independent way to assess platform security using the same open tooling available to everyone.
Every current Star Labs platform can achieve HSI:3, while StarFighter Ultra can achieve HSI:4 thanks to its additional hardware security capabilities. The level you actually see will also depend on how your system is configured – Secure Boot, for example, is disabled by default on our laptops.
What HSI Reports
One of the most useful things about HSI is that it doesn't just give you a headline level. It also explains how that result was reached.
HSI builds security in layers, so to reach a particular level a laptop must pass the checks for that level as well as every level below it. But the level itself is only part of the picture.
The report also reflects how your system is configured today. A Star Labs laptop might support Secure Boot, for example, but we leave it disabled by default so you can choose whether to use it. HSI will pick that up, which means the level reported out of the box may be lower than the level the hardware can achieve. The same applies to features such as kernel lockdown or encrypted swap.
That's why it's worth looking beyond the headline result. The real value is in the individual checks, because they show which protections your laptop supports, which ones are currently enabled, and where there may be room to improve your security.
HSI:1 - Core Platform Security
HSI:1 is where the foundations are laid. It covers many of the checks that help establish trust before Linux even starts, including things like TPM support, Secure Boot, protected firmware regions and signed firmware updates.
Why does that matter? Because some of the most important security decisions happen long before the operating system loads. Signed firmware helps ensure updates come from the expected source, while firmware write protection makes it much harder for software to modify the firmware itself.
On Star Labs laptops, our firmware packages also include checks such as board identity, version and rollback protection. If someone tries to install firmware intended for a different model, or an older version that shouldn't be installed, the update is designed to fail safely rather than being applied anyway.
HSI:2 - Additional Platform Protections
HSI:2 builds on those foundations with another set of platform security checks. Depending on the hardware, these can include things like IOMMU-backed DMA protection, debugging controls and checks that help verify the integrity of the boot process.
One example is the IOMMU. It controls which areas of system memory connected devices are allowed to access, helping protect against Direct Memory Access (DMA) attacks, where a malicious device attempts to bypass the operating system altogether.
HSI can also report checks related to Measured Boot. Although they're often mentioned together, Secure Boot and Measured Boot do different jobs. Secure Boot decides what code is allowed to run, while Measured Boot keeps a record of what actually ran during startup, making it possible to verify the boot process afterwards.
HSI:3 - Further Platform Hardening
By the time a laptop reaches HSI:3, the focus has shifted to another group of platform security checks that help strengthen the system against more advanced attacks.
The exact checks vary depending on the hardware and the version of fwupd, but they can include areas such as pre-boot DMA protection, processor control-flow protections and the security implications of different suspend states.
You don't need to remember what each of those does. The important point is that HSI is checking more than whether features simply exist - it is building up a picture of how well the platform is protected.
Every current Star Labs platform can achieve HSI:3.
HSI:4 - Additional Hardware-Backed Checks
HSI:4 builds on everything that comes before it by adding checks for advanced hardware security features where they're available.
On the StarFighter Ultra, that includes technologies such as Intel Total Memory Encryption (TME), which encrypts system memory, and Supervisor Mode Access Prevention (SMAP), an additional processor protection that helps prevent certain types of memory attack.
Not every platform supports these features, which is why HSI reports them individually rather than assuming they're present. As with every HSI level, the report shows exactly which checks your system supports and whether they're passing.
Protecting the Firmware
HSI is a useful way to inspect platform security, but it doesn't tell the whole story.
On supported Star Labs Intel platforms, we also implement protections such as BIOS Lock and SMM BIOS Write Protection, which help make firmware much harder to modify from the operating system.
Why is that important? If malware only exists within Linux, reinstalling the operating system will usually remove it. Firmware is different. If the firmware itself is compromised, that compromise can potentially survive a reinstall.
That's why protecting firmware against unauthorised writes is such an important part of platform security.
Check Your Own System
There are two ways to check your system's security status. If you're using GNOME, you'll find a graphical view under:
This lets you see your device's security status and explore the individual checks without using the terminal. Not every Linux desktop environment currently provides this graphical view, but you can check the same information from the terminal on any supported system with a recent version of fwupd installed:
fwupdmgr security
Whichever method you use, don't stop at the headline level. The individual checks are the useful part, showing which protections your laptop supports, which are currently enabled and whether there are any issues worth investigating.
Security You Can Inspect
No single tool can tell you everything about a system's security. HSI won't tell you whether you've chosen a strong password, installed trustworthy software or applied every available update.
What it does provide is something that's surprisingly useful: an open, independent way to inspect an important part of your laptop's platform security.
We didn't create HSI, and that's exactly why we think it's valuable. It's an open-source project that's available across supported Linux systems, giving everyone the same way to inspect and compare platform security.
We're pleased that every current Star Labs platform can achieve HSI:3, while StarFighter Ultra can achieve HSI:4 thanks to its additional hardware security capabilities. The level reported on your own machine will depend on its configuration, which is precisely why being able to inspect it is so useful.
Because, in the end, security is much more meaningful when you can inspect it for yourself than when you're simply asked to trust a specification sheet.